Situations
Somebody asked who owns security, and there was no answer
An auditor, a board member or an insurer asked for a name. Here's how to give them one.
The short answer
What this really means.
One named person has to be in charge of security, with the authority to make decisions. Your IT team and your tools can't fill that role on their own.
Start here
What to do first.
-
Admit the gap
Not having an owner is the finding. Write it down.
-
Name one person
Someone senior, with the authority to decide.
-
Write down the job
What they own, and who they report to.
-
Set a schedule
Regular reports to leadership, so ownership is visible.
Watch out
Where people go wrong.
-
Naming the IT manager by default
Running systems isn't the same as owning the risk.
-
Pointing at the IT company
They do the work. Someone at your business still owns it.
-
Naming a committee
When everyone owns it, no one does.
How we help
You don't have to do this alone.
A vCISO can be that named owner. We take the role, report to your leaders, and stay on.
Book a call Take the Cybersecurity Scorecard The vCISO program
Services that help
What this usually calls for.
-
Security Program Assessment
A report card on your security: what's strong, what's weak, and what to fix first.
-
Cyber Risk Management
One list of the risks that could really hurt your business, each with an owner and a plan.
-
Security Policy, Standards and Awareness
Security rules written for how your business really works, and staff who understand them.
Questions
Common follow-up questions.
Can we name our IT manager and move on?
Only if they have the time, the authority and the support. Usually they don't.
What does accountable actually mean in this context?
One person who answers for whether security is good enough, and makes the decisions to fix it.
Our provider says they handle security. Why is that not ownership?
They do the work they're contracted for. Deciding what work is needed is a different job.
How quickly can this be answered properly?
You can name an owner right away. Making the role real takes a written scope and regular reporting, which we set up with you.
Insights
Related reading.
-
Governance
What Current Regulation Requires Around Security Program Assessment
Federal regulations mandate regular security assessments for organizations handling controlled unclassified information (CUI). Executives are accountable for demonstrating that security controls are implemented correctly and operating as intended, but many organizations lack clear ownership of the assessment process. This guide explains the regulatory requirements, what leadership must oversee, and how to establish accountability.
Dr. Daniel Glauber, 10 August 2026